I believe parent was commenting about ability to run a CloudSQL instance with an internal IP in the same/different subnet as rest of the Compute Engine instance

I believe parent was commenting about ability to run a CloudSQL instance with an internal IP in the same/different subnet as rest of the Compute Engine instance. I'm drawing that conclusion because I've had the exact same use case and I ended up using SSL certs used by Cloud SQL instances to secure communication between my apps running on compute engine and CloudSQL. With RDS one can create a postgres/mysql instance that shares the same internal subnet thus negating need to open it up to external IPs, something I had to do after much deliberation because whitelist individual instance IP is just too much pain. [edit: I looked at the link, and created a test instance to make sure I wasn't missing on a config setting, still unable to use private network to communicate with Cloud SQL AFAIK]